1da27eb0745a2ecad481a30674cd87e7eb909b2e05280070bb59424bb2a1030a

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 04:17

Target

f73f052c473244660487fa8d10c95cae_JaffaCakes118.dll
Size

2.0MB
MD5

f73f052c473244660487fa8d10c95cae
SHA1

2761fd704b9457ab617589e77bd2a3032954701e
SHA256

1da27eb0745a2ecad481a30674cd87e7eb909b2e05280070bb59424bb2a1030a
SHA512

4f0f94e03b5c5441be4a0719a789fce22c8b8a8856e2104db9f53484f82ebcd3001fd8ef5c45eee37e91e6b5d17f86d99c6375f68061ad642b84804bed7981b4
SSDEEP

49152:tIs48vzm0qX59ZZaNeLut/MAyVOr6kcXMfKAfQ:tVBLV259PaNe4/wsr6kcXV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2968	4720	rundll32.exe	83
PID 4720 wrote to memory of 2968	4720	rundll32.exe	83
PID 4720 wrote to memory of 2968	4720	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f73f052c473244660487fa8d10c95cae_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f73f052c473244660487fa8d10c95cae_JaffaCakes118.dll,#1
  2⤵
  PID:2968

memory/2968-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download